3ae5c86ccbb42568151940e635a377d21a2cada8e35cf1e1f083a390410af977 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a5d83eeb6e5ed40fda37fc58c806d1b0_NeikiAnalytics
Size

67KB
Sample

240510-jnss8aef26
MD5

a5d83eeb6e5ed40fda37fc58c806d1b0
SHA1

b84b0049fc9991d0e58591ac717ca6bf247eddf6
SHA256

3ae5c86ccbb42568151940e635a377d21a2cada8e35cf1e1f083a390410af977
SHA512

08ff8d9272a0792faf7a725346a7bdbd318388c70d59a02692d663967c9b781ffccb17a11a430a9c2c7ca6e10bd9a46d9516ce5b8bd3e2f6e08a1c7a418b8b75
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Oqw8:ulg35GTslA5t3hw8

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  a5d83eeb6e5ed40fda37fc58c806d1b0_NeikiAnalytics
- Size
  
  67KB
- MD5
  
  a5d83eeb6e5ed40fda37fc58c806d1b0
- SHA1
  
  b84b0049fc9991d0e58591ac717ca6bf247eddf6
- SHA256
  
  3ae5c86ccbb42568151940e635a377d21a2cada8e35cf1e1f083a390410af977
- SHA512
  
  08ff8d9272a0792faf7a725346a7bdbd318388c70d59a02692d663967c9b781ffccb17a11a430a9c2c7ca6e10bd9a46d9516ce5b8bd3e2f6e08a1c7a418b8b75
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Oqw8:ulg35GTslA5t3hw8
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan